CVE-2021-44228-Scanner icon indicating copy to clipboard operation
CVE-2021-44228-Scanner copied to clipboard

Published 20 hours ago • verified publisher icon logpresso

Permissions not preserved in a JAR within a ZIP

Open mrpegman opened this issue 3 years ago • 2 comments

If you have a JAR with the targeted classes and that JAR is within a ZIP, then scanning the ZIP will remove permissions on the files within the JAR. This is a UNIX-only issue as far as I can tell. Opening up the JAR after scanning shows that the HOST OS was changed from UNIX to FAT and the UNIX-style permissions were stripped.

mrpegman avatar Jan 20 '22 14:01 mrpegman

You would have used fix option. Scanner does not modify any file while scanning.

xeraph avatar Jan 20 '22 14:01 xeraph

The command that I ran was: java -jar esp.jar --scan-log4j1 --scan-zip --fix fsc.zip

The esp.jar is the logpresso JAR. The fsc.zip file contains a JAR which when it gets scanned has the UNIX file permissions removed.

mrpegman avatar Jan 20 '22 15:01 mrpegman